The New Era of Data-Driven Fraud Enforcement

In recent years, the federal government has moved to detect healthcare fraud at greater speed and scale. A 2025 executive order required agencies to remove the hurdles that made sharing data across systems slow and difficult.¹ Advances in artificial intelligence, meanwhile, have let the government analyze that data faster than ever.

DOJ announced this year that it will operate cloud-computing resources within the Centers for Medicare & Medicaid Services’ Integrated Data Repository, deploying artificial intelligence tools to identify potential fraud.²

In June, DOJ announced a record-setting healthcare fraud takedown, charging 455 defendants in schemes involving more than $6.5 billion in alleged false claims. It was the first such takedown under the department’s new National Fraud Enforcement Division, and prosecutors stressed the machinery behind it: cross-agency data sharing, new analytics arrangements, and cases identified through data analytics.

Most of those 455 defendants allegedly set out to steal. But the same capability used to catch them also reaches companies with no intention to defraud. And that has major implications for virtually every healthcare and life sciences company that depends on government payments, from pharmaceutical manufacturers and healthcare practices to medical technology companies.

Exposure Without Intent

Under the False Claims Act, a company can be liable for false claims without ever intending to defraud. At scale, some of the claims an organization submits or causes to be submitted will inevitably be wrong. A company that does not act recklessly, but instead does what is reasonable to prevent those errors, is generally not penalized for the ones that slip through, though it may still have to return the money as an overpayment. 

What counts as reasonable, though, is not fixed. It moves with what is possible. When the best available tools caught only a fraction of errors, missing the rest may have been reasonable. As detection becomes cheaper and more widespread, the standard could rise, and the same misses that were once defensible may get harder to defend because the company could now have caught them. 

Of course, seeing a suspect claim is not the same as acting on one. The government still has to prove a case, and it can pursue only a fraction of what it now sees. But the direction of travel is clear: The wider its view, the more exposure that creates.

The Shrinking Self-Reporting Window

That exposure changes the calculus around self-disclosure. Because Medicare and Medicaid pay most claims automatically, a company’s exposure is often sitting in claims it has already submitted and been paid for, waiting to be found by whichever side looks first. 

A company that uncovers a problem in its own claims can report it and reduce its False Claims Act exposure, but only if it gets there before the government. The government now sees more than ever before — and sooner. For most companies, it still takes weeks or months to conduct an internal investigation, confirm what happened, and determine whether to report. In that time, analytics scanning data pooled across agencies may already have flagged the same problem.

The squeeze is intensifying. Detection is faster, so the government arrives sooner. DOJ has also moved to speed up its review of certain whistleblower suits, committing to decide within a set window whether to take a case over, let the whistleblower run with it, or drop it. And the government is not the only one that can see. The same analytics are increasingly available to private plaintiffs, and a growing industry of whistleblowers and their advisers now uses them to comb claims data for cases to file. 

DOJ’s recent Fraud Oversight through Careful Use of Statistics (FOCUS) initiative offered data miners the chance to meet with the Civil Fraud Section to discuss their capabilities and said it will prioritize working with those who have sophisticated technology. Because relators share in the recovery under the False Claims Act’s qui tam provisions, they have every reason to bring suits the government itself might never have pursued, which widens a company’s exposure well beyond what enforcers alone would reach. A company weighing whether and when to come forward now runs that decision against a clock it does not control and cannot see — and against parties with every incentive to file first.

Detection Is Not Enforcement

But a scheme the government or a relator can see is not necessarily a case they can win. The government still has to prove the company acted with real culpability, not just that a claim was wrong, and, when a company didn’t submit the claims itself, that its conduct actually caused them. 

Analytics also surface far more suspect activity than any prosecutor’s office can pursue, so enforcers concentrate on the largest cases and let many others pass. Being visible to the government and being pursued by it remain two different things.

Seeing Your Own Exposure

The government sees far more than it once did, and it is no longer the only one looking. The odds of a problem surfacing in a company’s claims are rising, and finding it first is the surest way to keep some control over what follows. What “seeing more” requires, though, depends on who you are.

Large incumbents face the steepest version of this. The system will increasingly assume that a company of that size can spot anomalous claims and flag suspicious patterns quickly and comprehensively and that it investigates and, when necessary, remediates what it finds.

Smaller companies are in a different position. Matching the government may not be possible. A growth-stage business likely cannot build a federal-scale detection apparatus, nor does it need to. But such companies should still maintain visibility into their own claims and into the financial relationships most likely to draw scrutiny, such as payments to physicians and referral sources. Scaled to their size, that visibility is enough to catch problems early, paired with the judgment to know what to do when something surfaces.

Investors are exposed earliest in the deal. A target’s paid claims are a latent liability, and the government can now see into them more clearly than a buyer may be able to through ordinary diligence. DOJ has pursued sponsors directly for a portfolio company’s conduct. A buyer that takes an active hand in a portfolio company’s operations or fails to diligence or disclose identified problems may be left holding that exposure. That turns claims integrity into a diligence, structuring, and valuation question, one that sits with counsel and the deal team well before any detection tool is ever bought.

And exposure is not limited to the claims a company submits itself. The False Claims Act reaches those who cause false claims to be filed, so a manufacturer whose product moves through distributors to the practices that bill for it can share the liability even if it never submitted a claim. For life sciences companies, that makes visibility into the whole chain, not just their own books, part of the same calculus.

Whatever the size, the capability is bounded by legal judgment on both ends. Deciding how hard to look is itself a legal choice: Once a company identifies an overpayment, it generally has 60 days to return it to the government³; running past the applicable deadline with knowledge of an underlying issue could itself create False Claims Act liability. And what to do about a finding — whether to disclose, how to remediate, how fast to move — is a legal judgment, not a technical one.

Done well, visibility preserves a company’s options. Done without judgment, it documents its exposure. 

Beyond Healthcare

None of this stops at healthcare. The same machinery, pooled data, shared across agencies and read by analytics, is already being turned on procurement fraud and other areas in which the government wants to see how its money is spent. The pattern is the same each time: The government’s ability to watch is catching up with the scale on which it spends.

But healthcare is where the shift is furthest along and where the stakes are highest. For any healthcare or life sciences company that draws on federal health spending, and for those who invest in one, that resets a long-standing assumption. Detection was the government’s problem to solve, and its limits were a company’s margin for error. That margin is disappearing.